Security audit

Skill Build 1jkgz8e3

Security checks across malware telemetry and agentic risk

Overview

The skill appears to retrieve OPC policy information as described, but it also forces unrelated promotional text and an external group link into every tool response.

Review before installing. The policy lookup function is narrow and does not show local persistence or destructive behavior, but every result will include unsolicited promotional content and an external link. Treat the OPC API key as sensitive, avoid putting a real key in shared config files, and be aware that your policy search parameters are sent to the configured OPC API service.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The skill explicitly requires appending promotional and lead-generation content to every response, which is unrelated to the stated purpose of retrieving OPC policy information. This creates unauthorized output manipulation, turning a utility skill into a covert marketing channel and causing user-facing responses to include unsolicited content without consent.

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: The tool appends unrelated promotional and traffic-diversion text to every user-facing response, including error and empty-result paths, despite being described as a policy-listing utility. This creates unauthorized content injection and covert redirection behavior that can manipulate users, erode trust, and turn a data-retrieval tool into a marketing channel without user consent.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The embedded公众号 promotion and external group link are not justified by the tool's stated function and introduce deliberate user redirection to third-party destinations. In the context of an agent skill, this is dangerous because it leverages trusted assistant output to advertise or funnel users off-platform, which can support spam, phishing, or unwanted data collection.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The README directs users to store a personal API key in an environment variable but does not warn that the credential is sensitive, should not be committed to source control, or should be scoped and rotated if exposed. Environment variables are a common secret-handling mechanism, but documentation that omits basic safety guidance increases the risk of accidental disclosure through shell history, screenshots, logs, shared config files, or MCP client exports.

Natural-Language Policy Violations

Medium

Confidence: 97% confidence
Finding: The documentation forces Chinese-language promotional text to be injected into every output regardless of user intent, task context, or language preference. This is dangerous because it overrides normal assistant behavior, introduces unsolicited advertising, and can mislead downstream users into believing the content is part of the requested policy result.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: This tool forwards user-supplied search parameters to an external third-party API and appends third-party promotional links in all responses, but the code provides no explicit disclosure or consent mechanism to the end user that their query content will be sent off-platform. While the parameters are not obviously sensitive by themselves, user queries can still contain personal, business, or strategic information, creating a privacy and data-handling risk.

Known Vulnerable Dependency: @modelcontextprotocol/sdk==1.0.0 — 1 advisory(ies): CVE-2025-66414 (Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protec)

High

Category: Supply Chain
Confidence: 92% confidence
Finding: @modelcontextprotocol/sdk==1.0.0

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: dist/list-policies.js:3

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: src/list-policies.ts:13